momo5502
b2eef2bf46
Align processor counts
2025-08-17 07:31:37 +02:00
momo5502
9c29f26647
Small fixes
2025-08-17 07:26:11 +02:00
momo5502
7d6648ade0
Extend clang-format column limit to 140
2025-08-16 14:55:07 +02:00
momo5502
5fbf065937
Handle debug strings via callback
2025-08-10 10:03:12 +02:00
CarlTSpeak
051cef2212
fix: handle VirtualAlloc invalid size and flags
2025-08-08 14:52:03 +01:00
CarlTSpeak
0aea1f5385
I just learned how clang-format works. Fail.
2025-08-08 11:22:56 +01:00
CarlTSpeak
210ab2930c
Fixed platform portability issues
2025-08-06 11:12:44 +01:00
CarlTSpeak
8b2c170236
Fixed clang exception. Again.
2025-08-06 11:01:42 +01:00
CarlTSpeak
ffea72d48a
Added basic pipe support to NtRead/WriteFile
2025-08-06 10:30:40 +01:00
CarlTSpeak
100638d8ea
Fixed clang-tidy issue
2025-08-05 16:26:13 +01:00
CarlTSpeak
85843ff5c9
Fixed cross-platform: removed MS-specific macro
2025-08-05 15:55:36 +01:00
CarlTSpeak
5f9bfd4694
Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker
2025-08-05 15:44:19 +01:00
CarlTSpeak
cae1cf5c1f
Added stubs for NtCreateNamedPipeFile NtReleaseWorkerFactoryWorker
2025-08-05 15:35:31 +01:00
momo5502
6eb4ef33ff
Handle invalid page protections
...
This fixes #420
2025-07-20 09:34:25 +02:00
Maurice Heumann
9e5a6b509b
Implement guard pages ( #406 )
...
Hey, looking for feedback on my guard page implementation.
I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.
This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.
The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21 )
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel ).
The test added to the `test-sample` binary seems to be passing.
Fixes #21
2025-07-17 17:41:06 +02:00
momo5502
ac2d34c143
Small cleanup
2025-07-12 15:40:04 +02:00
momo5502
7a3a5d760e
Fix thread deletion
2025-07-12 15:28:30 +02:00
3fault
1276c7e2bc
Update occurances of memory_permission to nt_memory_permission where needed
2025-07-01 19:04:22 -04:00
momo5502
08ae52710b
Prevent translation of relative files
2025-06-16 18:38:55 +02:00
momo5502
bda89b5d1e
Add more syscalls
2025-06-15 19:48:05 +02:00
momo5502
1421550764
Cleanup and fix NtQueryInformationProcess
2025-06-15 09:31:57 +02:00
Red
f14b16d080
Fix anti-debug detections for NtQueryInformationProcess with ProcessDebugObjectHandle
2025-06-14 15:00:53 +02:00
momo5502
906cec808a
Small fixes
2025-06-07 20:10:36 +02:00
momo5502
05c5f0a085
Final cleanup
2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9
Cleanup exception callbacks
2025-06-07 07:54:11 +02:00
momo5502
802e295bcc
Adapt more printing
2025-06-07 07:29:30 +02:00
momo5502
9372e27453
Fix module logging
2025-06-07 07:11:27 +02:00
momo5502
bc77faec3d
Move more logging into callbacks
2025-06-06 20:03:53 +02:00
momo5502
f2e0e91630
Isolate more analysis into analyzer
2025-06-05 18:59:27 +02:00
momo5502
956e73d839
Some fixes
2025-06-04 20:47:51 +02:00
momo5502
1f829463c1
Use more semantic logging
2025-06-04 20:22:28 +02:00
momo5502
de0d9a17a5
Small fixes
2025-06-04 20:19:47 +02:00
momo5502
84e8e86b94
Extract sus activity logging
2025-06-04 19:28:50 +02:00
Maurice Heumann
dcee2982ce
Update file.cpp
2025-06-03 11:18:10 +02:00
Igor Pissolati
9f32620220
Fix failing checks
2025-06-02 14:32:15 -03:00
Igor Pissolati
c67146ee45
Add new syscalls
2025-06-02 14:32:15 -03:00
Igor Pissolati
db1588623b
Add KSecDD device and support for devices in NtQueryObject
2025-06-02 14:32:15 -03:00
Igor Pissolati
cc2266d934
Add new pseudo-handles
2025-06-02 14:32:15 -03:00
Igor Pissolati
ad3046466e
Improvements to NtQueryInformationToken
2025-06-02 14:32:15 -03:00
momo5502
aa763c8392
Prepare more timer syscalls
2025-06-01 14:05:18 +02:00
momo5502
009961620b
Fix thread deletion
2025-06-01 13:57:14 +02:00
momo5502
da658e5178
Prepare timer support
2025-06-01 13:56:45 +02:00
momo5502
c605131a80
Small changes
2025-06-01 12:48:59 +02:00
momo5502
ed80b86e22
Fix compilation
2025-06-01 07:54:42 +02:00
momo5502
e763fdac54
Support more syscalls
2025-05-31 21:27:32 +02:00
momo5502
bc92023652
Fix directory enumation with filesystem mappings
2025-05-31 16:31:24 +02:00
momo5502
b6f4645420
Some more syscalls
2025-05-31 13:21:19 +02:00
momo5502
8abc7a65ef
Support svcctrl start event
2025-05-24 11:06:23 +02:00
momo5502
92bdf26669
Fix computername
2025-05-24 11:06:09 +02:00
Igor Pissolati
e0507aa2c5
Fix afd_endpoint::ioctl_connect
2025-05-21 19:28:27 -03:00